97c9a5cab96e4fa1adcaf5da236fbb479d539d48392ade77efaa030d66d1f5c5

Resubmissions

22-06-2024 16:01

240622-tgf6ystbre 10

22-06-2024 16:00

240622-tfz8faxgkp 10

22-06-2024 15:49

240622-s9d2mashmf 10

Analysis

max time kernel
146s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
22-06-2024 15:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Creal.pyc
Size

126KB
MD5

07b4276b2cfd33972d53fbac3371981b
SHA1

89dd5c5b0ec049b1d079740061dfb5a179f73880
SHA256

7a80bea513ebcf6cc9482a24dcccd46e53fd17f68aca7072b092cff7eb2839ab
SHA512

6d326ba8d6c6c19bffdef5c5791fb5a55c5e1202f6916b30c7bc4b3372e38344cbfc05c6e5bbaa4b141e4649e0e6e73a9c7474cd5094e7c4c47cce0805a9b795
SSDEEP

1536:kr9aqMamgphoWdUeOPZZ4GQmGwWaMIwk/JsVAVMRSlxXDEJ0ZVRW5D9Kv1X57mGm:kB7MaNdU8dQ/KS1WXINLsnN

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.pyc\ = "pyc_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\pyc_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\pyc_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\pyc_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\pyc_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.pyc	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\pyc_auto_file\shell	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2712	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2712	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2712	AcroRd32.exe
2712	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 3048	2360	cmd.exe	29
PID 2360 wrote to memory of 3048	2360	cmd.exe	29
PID 2360 wrote to memory of 3048	2360	cmd.exe	29
PID 3048 wrote to memory of 2712	3048	rundll32.exe	30
PID 3048 wrote to memory of 2712	3048	rundll32.exe	30
PID 3048 wrote to memory of 2712	3048	rundll32.exe	30
PID 3048 wrote to memory of 2712	3048	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Creal.pyc
1⤵
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Creal.pyc
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3048
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Creal.pyc"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:2712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
4c9678184997fc2bf8e596cac85a08ff

SHA1
a7f881b7f86c3d3c144ae7ae1699eca19d180c9f

SHA256
6fbcdbf3700a23919e751e165b9ba587d76d618b0e5d1c99c627940880bf9e24

SHA512
d11ca4452befddf7448c7e8121ad0417289fc7f42871841fd2fa0079db2f35287ae121c9f3ad8fbcdcf1cca41e4b05681fcf5e1c04decfdef888c990a24334c0

Download Submit